As users continue to increase their reliance on online resources to conduct business and pleasure, the importance of protecting privacy and facilitating secure transactions grows. Encryption of information is one method for providing privacy and security in the online environment. One encryption method involves the use of a public key that is shared openly with others. The public key is used to encrypt a message that is sent to the owner of the public key. The owner then uses a secret key to decrypt the message. The use of advanced cryptography such as public keys functions to counter “phishing” attacks and provides a new level of protection for online users.
One of the potential disadvantages of this type of cryptography is that when a public key is reused at many online sites, the public key becomes a new form of personally-identifying information. The public key can be thought of as a string of bytes that can be used as a “database key” in addition to being a cryptographic key. In this context, a public key can be employed to correlate and track a user's online activities across multiple online resources. For example, two web sites could compare the public keys registered at their sites, and, finding matches, could correlate the purchasing profiles of the owners of those keys in ways a user did not contemplate or sanction.
In addition, although a user will typically want to preserve his or her privacy when conducting online transactions, there are situations in which the user may want to allow web sites to share information about the user. For example, if a first web site offers discounted goods or services to members of a second web site, and the user is member of the second web site, the user may want to allow the first and second web sites to share information about the user so that the user can receive the discount.
Users therefore desire an online environment in which privacy and security concerns are addressed and in which users can control when and how online resources share user information.